jonz Posted August 20, 2008 Share Posted August 20, 2008 I am running CCleaner v.2.01.507 in a Terminal Server enviroment. It runs evertime a user logs into the TS. My eTrust ITM downloaded signatures at 7:45am... At 7:51am, when the next user logged in, the realtime scanner popped the following warnings: The Win32/FakeAv.CX was detected in C:\PROGRAM FILES\CCleaner\UNINST.EXE. Machine: xxxxx, User: xxxxxx . Status: Infected and The Win32/FakeAv.CX was detected in C:\PROGRAM FILES\CCleaner\UNINST.EXE. Machine: xxxxx, User: xxxxxx. Status: File was cured; system cure performed. Do you all think this is a false positive situation? During my googleing of this, i found some mention of false positives on the file a year or so ago. Link to comment Share on other sites More sharing options...
jonz Posted August 20, 2008 Author Share Posted August 20, 2008 Update... Every box on my network is now reporting this... Piriform should write a thank you note to CA, as they are removing the uninstall files so CCleaner cant be uninstalled =) Link to comment Share on other sites More sharing options...
jonz Posted August 20, 2008 Author Share Posted August 20, 2008 Another update! It thinks that the install file for the newest version is a virus also Here is the message: [time 8/20/2008 9:12:11 AM: ID 14: machine xxxxx: response 8/20/2008 9:12:57 AM] The Win32/FakeAv.CX was detected in C:\...\CCSETUP210[1].EXE. Machine: xxxxx, User: xxxxx. Status: File is cured and the machine needs to reboot to complete cure. I have used CCleaner for a long time, and know for a fact that is far from a virus or trojan. I can only assume that CA has failed me again with a false positive! Link to comment Share on other sites More sharing options...
Matt B. Posted August 20, 2008 Share Posted August 20, 2008 I'm getting the same message from eTrust today. It thinks the uninstall program is FakeAV.CX. I also think it's a false positive, but it would be nice if someone could confirm that. I'm going to check the forums at CA. Link to comment Share on other sites More sharing options...
Matt B. Posted August 20, 2008 Share Posted August 20, 2008 Can't see anything on the CA eTrust forums, but there is very little activity there and you can't post until you get approval. Link to comment Share on other sites More sharing options...
Zaur Posted August 20, 2008 Share Posted August 20, 2008 I'm getting the same mesage from CA eTrust antivirus. I've tried downloading previous versions of CCleaner, but whenever the setup file is downloaded CA eTrust antivirus deletes it... Link to comment Share on other sites More sharing options...
Matt B. Posted August 20, 2008 Share Posted August 20, 2008 I've submitted a question to the CA free email support. It may take a while to get a response. Link to comment Share on other sites More sharing options...
Zaur Posted August 20, 2008 Share Posted August 20, 2008 OK. I've added a topic on CA forum. Track it here: http://caforums.ca.com/ca/board/message?bo...p;message.id=19 Link to comment Share on other sites More sharing options...
Matt B. Posted August 20, 2008 Share Posted August 20, 2008 OK. I've added a topic on CA forum. Track it here:http://caforums.ca.com/ca/board/message?bo...p;message.id=19 Great, thanks. Also, on a related note, while I was poking around the Piriform site I noticed that they now have a defragmenting program. I thought I would try it, but when I downloaded the installer, I got the same FakeAV message! So it's not just CCleaner. Link to comment Share on other sites More sharing options...
Zaur Posted August 20, 2008 Share Posted August 20, 2008 Great, thanks. Also, on a related note, while I was poking around the Piriform site I noticed that they now have a defragmenting program. I thought I would try it, but when I downloaded the installer, I got the same FakeAV message! So it's not just CCleaner. right! Same thing with daemon4300-LITE.exe (Daemon-Tools). I've updated the thread at CA forum. Link to comment Share on other sites More sharing options...
Moderators Andavari Posted August 20, 2008 Moderators Share Posted August 20, 2008 Probably just another false positive! Files can be verified using two free online single file virus scanning services that use multiple virus scanners, there's nothing to install as you only upload the files to them: * http://virusscan.jotti.org/ * http://www.virustotal.com/ This post has been reported to the owner of Piriform, so that something can be done. Link to comment Share on other sites More sharing options...
Darkmatter Posted August 21, 2008 Share Posted August 21, 2008 I am getting this same error in several uninstall.exe programs on my machine. It's likely a problem with CA's detection engine. Link to comment Share on other sites More sharing options...
NK2U Posted August 21, 2008 Share Posted August 21, 2008 Another update! It thinks that the install file for the newest version is a virus also Here is the message: [time 8/20/2008 9:12:11 AM: ID 14: machine xxxxx: response 8/20/2008 9:12:57 AM] The Win32/FakeAv.CX was detected in C:\...\CCSETUP210[1].EXE. Machine: xxxxx, User: xxxxx. Status: File is cured and the machine needs to reboot to complete cure. I have used CCleaner for a long time, and know for a fact that is far from a virus or trojan. I can only assume that CA has failed me again with a false positive! I got the same thing too, it deleted the install and uninstall files on my system tonight. Roland, NK2U Link to comment Share on other sites More sharing options...
Natalie_ca Posted August 21, 2008 Share Posted August 21, 2008 I'm getting the same message from eTrust today. It thinks the uninstall program is FakeAV.CX. I also think it's a false positive I'm glad that I'm not the only one! I had to lower my firewall briefly and thought I picked up a virus! LOL Given the fact that so many are having the same problem with the same file after a recent anti virus update, it's obvious that it's a false positive due to the updated signature from CA Antivirus. It isn't the first time they've messed up. At least this time they aren't flagging valid Window System files like they did a month ago! Link to comment Share on other sites More sharing options...
YoKenny Posted August 21, 2008 Share Posted August 21, 2008 I'm glad that I'm not the only one! I had to lower my firewall briefly and thought I picked up a virus! LOL Given the fact that so many are having the same problem with the same file after a recent anti virus update, it's obvious that it's a false positive due to the updated signature from CA Antivirus. It isn't the first time they've messed up. At least this time they aren't flagging valid Window System files like they did a month ago! I never did like anything from CA. "Education is what remains after one has forgotten everything he learned in school." - Albert Einstein IE7Pro user Link to comment Share on other sites More sharing options...
davey Posted August 21, 2008 Share Posted August 21, 2008 OK. I've added a topic on CA forum. Track it here:http://caforums.ca.com/ca/board/message?bo...p;message.id=19 Update from MrG here. http://forum.piriform.com/index.php?showtopic=17335&hl= Situation resolved with fix from CA. Ca users must update. davey Link to comment Share on other sites More sharing options...
Matt B. Posted August 21, 2008 Share Posted August 21, 2008 Update from MrG here. http://forum.piriform.com/index.php?showtopic=17335&hl=Situation resolved with fix from CA. Ca users must update. davey Yes, I think we're in the clear now. Today I downloaded the install program for Defraggler and did NOT get the virus alert. Whew! I had some worried moments yesterday when these alerts were popping up all over. Link to comment Share on other sites More sharing options...
AZMoosie Posted August 22, 2008 Share Posted August 22, 2008 I never did like anything from CA. I'm new to this Forum and registered because of the Trojan detection by my CA security suite. I rarely download software, and hardly ever 'free' software, but I did download CCleaner because of Kim Komando endorsements and other reviews I have read. I was very distressed by the Trojan detection notice/cleanup. While I am now somewhat relieved to learn this was a false positive situation, I'm even more relieved that my CA security software errs on the side of caution. Everyone has their own likes and dislikes; I'd rather have a security product that makes a mistake to protect me, rather than one which fails to do so. Savor life, and smile... Link to comment Share on other sites More sharing options...
Moderators hazelnut Posted August 22, 2008 Moderators Share Posted August 22, 2008 Welcome to the forum AZMoosie Support contact https://support.ccleaner.com/s/contact-form?language=en_US&form=general or support@ccleaner.com Link to comment Share on other sites More sharing options...
Moderators Andavari Posted August 22, 2008 Moderators Share Posted August 22, 2008 I'd rather have a security product that makes a mistake to protect me, rather than one which fails to do so. Welcome to the forums! I personally would rather never have a false positive from anti-malware software. If they're falsely detecting program files those are surely easy to reinstall, however; if and when they start falsely targeting Windows OS files themselves that's where a serious problem could arise. Back when I used eTrust Antivirus (and I used it for years) I did like it allot until they started bloating it with the control center, bugs, etc., then the appeal was completely lost. Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now